Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

SecuriteIn...19.exe

windows7-x64

10

SecuriteIn...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 08:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe

  • Size

    997KB

  • MD5

    5be047c4918352d2c4e0b7b767442f49

  • SHA1

    b1e516c00130153bb1e16168be84c192d37f70da

  • SHA256

    8bd7c472ccc01bdc5bc39c49af563d4f17b283b61a9612d0048eda5510a1741f

  • SHA512

    18d6f2134e76faacac43f644db391d15b3f2c43db829f3e4b876fca701d582e5ac028f1cecb6aba89115880bc482fdd4ea499c71db945d90b86fd86c53a7c03a

  • SSDEEP

    24576:s+TdsTkf6lDpUVM7fMbzoHND3PwG3KNLctcRKX/N8I:xT2S6sGMb8HpwybtcRul

Score
10/10
remcosevans persistencerat

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

Evans

C2

46.183.216.163:8107

127.0.0.1:8107

10.26.173.68:8107
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-EFXK55

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1316
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:208
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
      C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
      2⤵
        PID:1392
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
        C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
        2⤵
          PID:2340

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        28854213fdaa59751b2b4cfe772289cc

        SHA1

        fa7058052780f4b856dc2d56b88163ed55deb6ab

        SHA256

        7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

        SHA512

        1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        16KB

        MD5

        46effae8e8f305de3ad3db3e8dc8aab2

        SHA1

        255ad759e17a216c673485119683cefcb3d17b5c

        SHA256

        ae99ea6eb4eb0d7c598f19150eb3a3e3d5df3f905247dbed8965169fa890cd35

        SHA512

        d1967f201858b682836fbb7aaabb6763efdcca7648ddea2ac7ecae8be91a701d554fa9df6fa750d1ecba4ab13442ba3bd01f7b30c15d154dc9dba7b0b4ffdadb

        Download Submit

      • memory/208-145-0x0000000006000000-0x000000000601A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/208-144-0x00000000071B0000-0x000000000782A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/1316-138-0x0000000004D40000-0x0000000005368000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/1316-139-0x0000000004BF0000-0x0000000004C12000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1316-140-0x0000000005470000-0x00000000054D6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1316-141-0x0000000005550000-0x00000000055B6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1316-142-0x0000000005B30000-0x0000000005B4E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1316-136-0x0000000002210000-0x0000000002246000-memory.dmp

        Filesize

        216KB

        Download

      • memory/2340-150-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/2340-152-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/2340-153-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/2340-154-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

        Download

      • memory/3928-134-0x0000000005140000-0x00000000051D2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/3928-133-0x0000000005450000-0x00000000059F4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3928-132-0x0000000000280000-0x000000000037E000-memory.dmp

        Filesize

        1016KB

        Download

      • memory/3928-137-0x0000000004E30000-0x0000000004E3A000-memory.dmp

        Filesize

        40KB

        Download